基于邮件特征匹配的Botnet检测方法

Botnet detection method based on email characteristic match

为降低特征提取的复杂度,提高分类速度,提出了一种基于邮件特征匹配的僵尸网络检测方法。不依赖于邮件具体内容和网络流量分析,通过对原始邮件进行概化,进而得到邮件特征值,然后利用海林格距离在僵尸网络邮件特征库中找到最匹配的值,从而检测发送垃圾邮件的僵尸网络类型。实验结果表明,该方法在预构建特征库的情况下对大量邮件进行分析,具有较高的效率和正确率。

To decrease the complexity of Botnet characteristic extraction and improve the speed of classification, a Botnet detection method based on Email characteristic match, which relies on neither Email detailed contents nor traffic analysis is presented. Raw emails are abstracted and Email characteristics are generated. Hellinger distance is used to find the most match characteristic in Botnet Email characteristic repository, then the Botnet that send the spam is classified. Experimental results show that the proposed method gained good accuracy and high efficency if enough spam Emails are trained and Botnet Email characteristic repository is well generated.